SekitCrosswalk
ENES
Start now
ISO/IEC 27001:2022 · derived mapping target

A.5.20Addressing information security within supplier agreements

Write relevant security requirements into supplier contracts so expectations are clear and enforceable. Spell out responsibilities before problems arise, not after.

Mapping at a glance
A.5.20Addressing information security within supplier agreementsISO/IEC 27001:2022
RCF-0026Third-party risk managementGovernance & Risk · ProcessRCF-0319Contractual security clausesSupply Chain Security · PolicyRCF-0320Contractual security clausesSupply Chain Security · ProcessRCF-0321Contractual security clausesSupply Chain Security · TechnicalRCF-0325Offboarding vendorsSupply Chain Security · Policy

A.5.20 is covered by 5 Sekit CSF controls. Open in the full graph →

Mapped from the Sekit CSF

The Sekit controls that cover this requirement, lens by lens.

RCF-0026Third-party risk management · ProcessequivalentEmbedding breach notification, data protection terms and audit rights into supplier contracts, then verifying them at signing and renewal, is A.5.20's requirement carried out step by step.RCF-0319Contractual security clauses · PolicyequivalentRequiring binding security and data protection clauses in every in-scope supplier contract is A.5.20's core requirement: write the expectations into the agreement itself.RCF-0320Contractual security clauses · ProcesssupportsTracking whether suppliers meet their contractual obligations, and acting on non-compliance, is what stops A.5.20's clauses from being filed and forgotten after signing.RCF-0321Contractual security clauses · TechnicalsupportsKeeping contracts and their security obligations in a system that surfaces renewal and compliance dates is the technical backbone that makes A.5.20's contract terms enforceable over time.RCF-0325Offboarding vendors · PolicysupportsA formal supplier exit clause guaranteeing access removal and data return is one of the specific security terms A.5.20 asks organisations to write into supplier agreements.

NIST CSF 2.0 counterparts

Reached through the Sekit CSF controls both map to — a mapping, not a formal equivalence.

GV.SC-06 Due diligence before engagementGV.SC-04 Suppliers known and prioritizedGV.SC-03 Supply chain risk integratedGV.SC-07 Supplier risk managed over relationshipGV.SC-08 Suppliers in incident planningGV.SC-01 Supply chain risk program establishedGV.SC-05 Supply chain requirements in contractsGV.SC-02 Supplier roles and responsibilities establishedGV.SC-09 Supply chain practices integrated in lifecycle

ISO/IEC 42001:2023 — Annex A counterparts

A.10.3 SuppliersA.7.3 Acquisition of data

Cyber Essentials counterparts

CE4.1 Manage the account lifecycle

In practice

In practice this is a contract clause library: standard security and data protection language legal or procurement pulls into every supplier agreement rather than negotiating from scratch each time. Auditors ask to see a sample contract from a supplier handling sensitive data and check whether the clauses made it into the signed document, not only the vendor's proposed terms. The common failure is a company with good clause language sitting in a template but never inserted into contracts signed before procurement adopted the template, leaving older, still-active suppliers uncovered.

Common gaps

Security clauses exist in the standard contract template, but several active supplier contracts predate the template and were never amended to include them.
The contract includes a right-to-audit clause, but it has never been exercised against any supplier since signing.
Breach notification terms in the contract do not specify a timeframe, leaving a vague promise as the only obligation on a supplier with real access to customer data.

Questions your auditor will ask

What security requirements are written into your supplier contracts?
Point to the standard clause set covering breach notification, data protection terms and audit rights, then show it present in a signed contract with a data-handling supplier.
Do older supplier contracts include the same protections as new ones?
Identify any contracts signed before the current clause template was adopted, and describe the plan or timeline for bringing them up to the same standard.
How do you know if a supplier is meeting the security obligations in their contract?
Show the tracking process that checks stated obligations against supplier behaviour and the escalation path for non-compliance.

Where regulation demands it

NIS2 art. 5.1 (Supply chain security policy) requires the same contractual approach A.5.20 asks organizations to take with suppliers.
ENS op.ext.1 (Contratación y acuerdos de nivel de servicio) is the equivalent baseline for security terms in service agreements.

Related controls

Via the shared Sekit CSF topic, not the framework's own index.

A.5.16 Identity managementA.5.18 Access rightsA.5.19 Information security in supplier relationshipsA.5.21 Managing information security in the ICT supply chainA.5.22 Monitoring, review and change management of supplier servicesA.8.15 LoggingA.8.16 Monitoring activitiesA.8.30 Outsourced development
Ask Sekura: “What evidence proves A.5.20?”
Also via MCP, free with account